from_exploit_to_a_shell_code

From Exploit to a Shell-Code

Software vulnerability is basically an incorrect or invalid handling of input
parameters passed to a vulnerable program or simply software bug. A specially
crafted input exploiting such vulnerability is called software vulnerability
exploit or simply exploit.

If the software vulnerability is unknown to the others or undisclosed to the
software manufacturer then the actual code that uses it often called a zero-day
exploit or a zero day attack.

A common lifecycle of the zero day exploit is as follows:

1.&nbsp The software manufacturer releases product containing the vulnerability,
usually an unknown one.
2.&nbsp The attacker finds the vulnerability before software developer does or
before he was informed by the users.
3.&nbsp The attacker creates and distributes an exploit.
4.&nbsp The manufacturer finds the vulnerability and starting writing the fix.

Since the attackers wont announce, for an understandable reason, that they have
found a vulnerability it might take several months to find out about the existence
of such an exploit. In some cases it might take even years like in case with
Microsoft IE when it confirmed the existence of vulnerability in IE 7 which affected
previous versions as well and due to this fact the zero day exploits are considered
the most dangerous and undetectable.

Every exploit contains a part called a shell-code. An initial purpose of the
shell-code is to start an operating shell program that provides a communication
interface between user and operating system and to establish a connection with
remote control server (for example attacker's computer) for further instructions.
Once the shell-code is injected and the control of the compromised machine is
gained, the malware or botnet agent will be downloaded and installed, the new
station will be attacked or any other scenario may occur.
The following image shows the structure of exploit and shell-code.

FILE BODY

NOP SLED

SHELL-CODE BODY

FILE BODY

Picture 1 - exploit structure

The NOP SLED is used to catch instruction pointer register
of CPU and transfer it to body of the shell-code. NOP sled is comprised of a
meaningless sequence of single or multi-byte instructions which have only one
purpose, to start execution of a shell-code from a correct position.

Polymorphic shell-codes

Plain exploits may be easily detected by anti-virus engines simply by using
recognition patterns of NOP-sleds, exploit (shell-code) content or body.
To avoid this, malware writers develop a polymorphic shell-code that mutates
from generation to generation (from execution to execution) while keeping original
execution algorithm. As in case of virus mutation, where different packers are
used to hide its real code, shell-code mutation is based on different encryption
engines which modify exploit's body keeping the original shell-code algorithm.

The following image shows structure of exploit and polymorphic shell-code.

FILE BODY

NOP SLED

DECRIPTION PROCEDURE

SHELL-CODE BODY

FILE BODY

Picture 2 - encrypted exploit structure

As it could be seen from Picture 2, the encrypted exploit
as well as plain exploit starts with NOP sled which transfer instruction pointer
register to next exploit's section. Unlike the regular exploit the NOP sled of
the encrypted exploit is followed by decryption procedure that is used to decode
the encoded shell-code.